Privacy policy

Bibliography Verifier, a Google Docs add-on published by Tomorrowish LLC. Last updated 24 October 2026.

The short version

The add-on reads only the reference list of the document you have open, and only when you press Check references.
Each reference entry is sent to our lookup server to be looked up in public scholarly indexes. We do not store the text of your references, your document, or who you are.
No account, no ads, no selling or sharing of data, and nothing is used to train AI models.

What the add-on can access in Google Docs

It asks Google for three permissions, and uses them like this:

View and manage documents that this application has been installed in (documents.currentonly): read the paragraphs under a heading named References, Bibliography or Works Cited (or the paragraphs you select), and make the corrections you click. It cannot open your other files.
Display and run third-party web content in prompts and sidebars (script.container.ui): show the sidebar.
Connect to an external service (script.external_request): send reference entries to our lookup server. The add-on's manifest only allows requests to that server's address, https://aaon.pro/api/refverify/.

The add-on never reads your email address, contacts or Drive, and never edits the document unless you press a fix button or ask it to add the check log or a one-line note.

What is sent, and to whom

When you check, the text of each reference entry (up to 1,500 characters each) goes over HTTPS to our lookup server, which runs on Vercel. The checker pulls out the title, authors, year, DOI and any link, and asks these public services about them:

Crossref, DataCite and the DOI Foundation resolver
PubMed (US National Library of Medicine)
arXiv and OpenAlex
Open Library and the Library of Congress
for web references: the cited link itself, and the Internet Archive

These requests come from our server, not from your computer, and carry no information about you.

What we keep

No reference text and no documents. The server does not write request contents to logs or storage.
To avoid asking an index the same question twice, the index answers are held in the server's memory for up to six hours. They are never written to disk and disappear whenever the server restarts.
Vercel, which hosts the lookup server, keeps standard request logs (time, path, status code, timing) for a short period under its privacy policy. They do not include the references you send.
Counts. When you run a check, apply a fix, or a check finds an entry that is in no index, the sidebar opens a tiny page on the lookup server so that Vercel Web Analytics counts the event. It is cookieless and records the page path, referring site, country and device type. No reference text and no document or user identifier are sent.

What is stored in your Google account

In the add-on's own settings area of your Google account (Apps Script user properties, which only this add-on can read), it keeps a daily count of how many references you checked in each document, stored as short one-way fingerprints, not text. If you enter a Pro key, the key and its expiry date are kept there too. Uninstalling the add-on in Google Docs removes its access.

Google user data

Bibliography Verifier's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Data from your document is used only to look up and correct its references, at your request.

Children

The add-on is not directed at children under 13.

Changes and contact

If this policy changes, the date at the top changes and the previous version stays in the site's public history. Questions: hello@tomorrowish.dev.